AIKIDO-2026-266515
mercadopago/dx-php is vulnerable to Path Traversal
59
Medium Risk
This Affects:
mercadopago/dx-phpTL;DR
Several client methods in the Mercado Pago PHP SDK build API request paths by interpolating caller-supplied string identifiers into URL templates with sprintf without URL-encoding them. When an application forwards attacker-controlled identifier values into methods such as order, customer card, chargeback, preference, and point lookups, values containing path separators or ../ sequences can alter the request path and make the SDK target unintended API endpoints. The fix wraps the identifier parameters in rawurlencode before constructing the path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes attacker-controlled identifier values into the affected client methods.
Background info
mercadopago/dx-php is vulnerable to Path Traversal in versions 3.0.0 - 3.12.0.
How to fix this
Upgrade the mercadopago/dx-php library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant